Unknown administrator accounts in WordPress

2026-09-12 · updated 2026-10-07

When you find an account you did not create, the first instinct is to delete it. That is understandable but premature.

What the account tells you

The creation date is an approximate breach time. Log analysis starts from there.
The email address often recurs across campaigns and helps identify the toolkit used.
The last login shows whether access is still active.

Deleting the account destroys all of this, and if the attacker still has another route in, they simply create a new one.

In the cases we have investigated, a rogue administrator almost always comes with at least one of these:

That is why deleting the account without investigating usually means it is back within a week. More on that in the article about reinfection.

2026-10-02

Malicious code rarely announces itself. These twelve signs mean something is already happening on your site.

2026-09-27

Redirect malware works selectively: the administrator never sees it, while visitors from Google land somewhere else.

2026-09-22

Search results show Japanese or Chinese text under your site name. Here is what is actually happening.